ISO Pre-Assessment Audit and Gap Analysis in Saudi Arabia

A pre-assessment audit establishes how far the existing arrangements of an organisation meet a management system standard before the certification audit begins, and itmad provides pre-assessment audits and gap analysis in Saudi Arabia with Saudi-based auditors and a travelling team. A pre-assessment is diagnostic, not corrective: itmad reports what is missing and does not design the solution. itmad has worked in Saudi Arabia for more than 10 years. Last reviewed: October 2026.

What a pre-assessment is

A pre-assessment establishes how far the existing arrangements of an organisation meet a standard, before the certification audit begins. A pre-assessment is optional, and organisations that skip a pre-assessment often should not have: a major non-conformity at stage 2 stops the certification decision, and closing a major non-conformity means corrective action, evidence of effectiveness, and in some cases a return visit.

What the pre-assessment review covers

• Documented informationWhether the policies, procedures and records that the standard requires exist, and whether the documents describe what the organisation actually does rather than what a template said.
• Implementation on siteWhether documented arrangements are applied in practice. Implementation is where most gaps appear: the system exists on paper and stops at the office door.
• InterviewsDiscussion with the people responsible for each process, since arrangements that nobody can describe will not survive a certification audit.
• Scope and boundariesWhether the intended certification scope is accurate, achievable and covers what clients will expect the scope to cover.
• Records and evidenceWhether the system has run long enough to have generated the evidence that a certification auditor will ask for: internal audits, management review, corrective actions closed out.
• Clause-by-clause gap reportEach relevant clause assessed, with what is in place, what is missing, and an indication of the effort required to close each gap.

The most common pre-assessment findings

Three gaps account for most delayed certifications, and all three are avoidable. The first is internal audits not yet conducted, or conducted by people auditing their own work. The second is management review not yet held, or held without the inputs that the standard requires and with no decisions recorded. The third is a system implemented too recently to have generated evidence, because certification auditors need to see the system operating over time, not a folder assembled the week before.

Diagnostic, not corrective

itmad is a certification body, and a pre-assessment reports what is missing without designing the solution. A pre-assessment does not recommend how to structure procedures and does not write anything for the organisation. ISO/IEC 17021-1 prohibits a certification body from consulting on the system that the body certifies, and that restriction is what allows the same body to carry out both the pre-assessment and the certification audit without compromising the certification decision.

Organisations sometimes find the restriction frustrating. The alternative is worse: a certification body that helps to build the system and then certifies the system has issued a certificate that means nothing to the client who asked for the certificate.

When to commission a pre-assessment

• Ahead of first certification, where nobody in the organisation has been through the process
• Before transition to a revised edition of a standard
• Where a previous certification audit produced major non-conformities
• After significant organisational change: new sites, acquisitions, changed scope
• Where certification is tied to a contract award date and the timeline cannot slip
• Before adding a standard to an existing certified system

Timing of a pre-assessment

A pre-assessment carried out too early finds gaps in a system that is still being built, which reveals little. A pre-assessment carried out too late leaves no time to act on the findings. The useful window is once the system is implemented and has been running long enough to generate records, but with enough time remaining before the certification audit to close what is found: typically two to three months before the certification audit, and longer where internal audits and management review have not yet been held.

Which standards

Pre-assessment is available against the standards that itmad audits in Saudi Arabia, including ISO 9001, ISO 14001, ISO 45001, ISO 22000 and HACCP, ISO 27001, ISO 22301, ISO 50001, ISO 37001 and ISO 22716, and for integrated systems covering more than one standard at once.

How itmad delivers pre-assessment audits in Saudi Arabia

itmad delivers pre-assessment audits in Saudi Arabia through Saudi-based auditors and a travelling team. itmad provides the audit and the gap report, and the organisation remains responsible for closing the gaps.

What itmad provides

• A gap report addressing each relevant clause of the standard
• What is in place, what is missing, and what evidence was examined for each clause
• Gaps prioritised by whether the gap would result in a major or minor finding
• An indication of the effort required to close each gap
• Assessment of whether the intended certification scope is achievable
• A realistic view on whether the target certification date is attainable

Contact itmad in Saudi Arabia

itmad, Riyadh, P.O. Box 11421, Kingdom of Saudi Arabia. Telephone: +966 11 205 8471.

Frequently asked questions

What is a pre-assessment audit?

A pre-assessment audit establishes how far the existing arrangements of an organisation meet a management system standard, before the certification audit begins. The pre-assessment produces a gap report that shows what is in place, what is missing, and the effort required to close each gap.

Is a pre-assessment audit mandatory?

No. A pre-assessment is optional, but organisations that skip a pre-assessment often should not have, because a major non-conformity at stage 2 stops the certification decision. Closing a major non-conformity means corrective action, evidence of effectiveness, and in some cases a return visit.

When should a pre-assessment audit take place?

The useful window is once the system is implemented and has been running long enough to generate records, with enough time remaining before the certification audit to close what is found. That is typically two to three months before the certification audit, and longer where internal audits and management review have not yet been held.

Does a pre-assessment design the solution?

No. A pre-assessment is diagnostic, not corrective: the pre-assessment reports what is missing and does not design the solution, recommend how to structure procedures, or write anything for the organisation. ISO/IEC 17021-1 prohibits a certification body from consulting on the system that the body certifies.

What are the most common pre-assessment findings?

Three gaps account for most delayed certifications: internal audits not yet conducted or conducted by people auditing their own work, management review not yet held or held without the required inputs and decisions, and a system implemented too recently to have generated evidence. All three are avoidable.

Does itmad use auditors based in Saudi Arabia?

itmad uses both Saudi-based auditors and a travelling team for pre-assessment audits in Saudi Arabia. itmad can be contacted in Riyadh on +966 11 205 8471 to discuss a pre-assessment.